Importing es/reflect/set pollutes Object's prototype with {a: 1} in IE11

[burkov]

Following piece of code leaves field a set to 1 in Object's prototype in IE11. This breaks jquery.keyfilter for instance and also looks strange in dev console.

// MS Edge 17-18 Reflect.set allows setting the property to object
// with non-writable property on the prototype
var MS_EDGE_BUG = fails(function () {
  var object = definePropertyModule.f({}, 'a', { configurable: true });
  // eslint-disable-next-line no-undef
  return Reflect.set(getPrototypeOf(object), 'a', 1, object) !== false;
});

$({ target: 'Reflect', stat: true, forced: MS_EDGE_BUG }, {
  set: set
});

Think it should be cleaned up right after the test with something like delete Object.prototype.a

[daniel-civicore]

This is also happening with arrays. Not sure if it is happening due to the same code or not but same thing is being seen.

new Array().a
// 1

This causes major issues in the case of arrays because if you try to loop over the array it returns "a" as a key:
for (var key in [1,2,3]) {
console.log(key);
}
// 0
// 1
// 2
// a

This ends up breaking most things, including jQuery. This is also an issue in Safari 9.

[daniel-civicore]

So I found more details on my specific issue. We include google charts on our page: https://www.gstatic.com/charts/loader.js

If you look at this it appears to do some polyfills for some array functionality. If these polyfills loads before the core-js polyfills then it throws this error. However, if we load core-js first, then it doesn't have the issue. So I am guessing something this is doing is confusing core-js.

This wasn't always an issue so I think the google charts must have been updated recently.

[zloirock]

It's a bug in a 3rd party polyfill that does not support receiver argument of Reflect.set. It's not a core-js issue.

[zloirock]

I'll add a workaround since it's very simple.